@yansigit/opencodex 2.36.1 → 2.36.2-dev.20260829.52

package/src/server/index.ts

@@ -60,7 +60,7 @@ import { runAlibabaRegionStartupMigration } from "../providers/alibaba-region-st
 import { runModelRenameStartupMigration } from "../providers/model-rename-startup";
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
 import { providerCodexAccountMode } from "../providers/registry";
-import type { StorageCleanupPolicy } from "../types";
+import type { OcxConfig, StorageCleanupPolicy } from "../types";
 import { MAX_DECOMPRESSED_BODY_BYTES } from "./request-decompress";
 import {
   CodexAccountCooldownError,
@@ -158,6 +158,7 @@ import {
   jsonResponse,
   admissionFields,
   resolveApiAuth,
+  resolveDataPlaneAdmissionSecret,
   resolveResponsesApiAuth,
   requestPolicyView,
   type RequestPolicyView,
@@ -166,6 +167,10 @@ import {
   withCors,
   withManagementCors,
 } from "./auth-cors";
+import {
+  managementBodyTooLargeResponse,
+  readManagementJsonBody,
+} from "./management/body";
 export {
   assertServerAuthConfig,
   corsHeaders,
@@ -210,6 +215,8 @@ import {
 import { SYSTEM_RESTART_CAPABILITY_VERSION } from "../lib/system-restart-contract";
 import { LOCAL_PROVIDER_RELOAD_CAPABILITY_VERSION } from "../lib/local-provider-reload-contract";
 import { createReadinessGate, type ReadinessGate } from "./readiness";
+import { allowPlaintextRemoteForTests } from "../lib/test-server-start";
+import { canonicalServerOrigin } from "../lib/server-tls";
 import {
   createRuntimePackageTreeIntegrityGuard,
   type PackageTreeIntegrityGuard,
@@ -217,18 +224,22 @@ import {
 import { detectInstall } from "../update/index";
 import { runAiStudioNativeLogin } from "../oauth/aistudio-native-daemon";
 
-function isAiStudioSessionOrigin(origin: string | null): boolean {
-  return !!origin && (origin.startsWith("chrome-extension://") || origin === "https://aistudio.google.com");
+function isAiStudioSessionOrigin(origin: string | null, config: Pick<OcxConfig, "corsAllowOrigins">): boolean {
+  return !!origin && (
+    origin === "https://aistudio.google.com"
+    || (origin.startsWith("chrome-extension://") && config.corsAllowOrigins?.includes(origin) === true)
+  );
 }
 
-function withAiStudioSessionCors(resp: Response, req: Request): Response {
+function withAiStudioSessionCors(resp: Response, req: Request, config: RequestPolicyView): Response {
   const origin = req.headers.get("Origin");
-  if (isAiStudioSessionOrigin(origin) && origin) resp.headers.set("Access-Control-Allow-Origin", origin);
+  if (isAiStudioSessionOrigin(origin, config) && origin) resp.headers.set("Access-Control-Allow-Origin", origin);
   return resp;
 }
 
 export const MAX_WS_FRAME_BYTES = 50 * 1024 * 1024;
-const WEBSOCKET_IDLE_TIMEOUT_SECONDS = 0;
+const WEBSOCKET_IDLE_TIMEOUT_SECONDS = 255;
+const WEBSOCKET_BACKPRESSURE_LIMIT = 1024 * 1024;
 const LIVE_SIDEBAND_PENDING_MAX = 32;
 const LIVE_SIDEBAND_PENDING_BYTES_MAX = 1024 * 1024;
 const LIVE_SIDEBAND_CLOSE_FALLBACK_MS = 1_000;
@@ -407,11 +418,16 @@ function attachLiveSidebandUpstream(
         return;
       }
       logLiveSidebandFrame("u2c", event.data);
-      if (typeof event.data === "string") ws.send(event.data);
-      else if (event.data instanceof ArrayBuffer) ws.send(event.data);
-      else if (ArrayBuffer.isView(event.data)) {
-        ws.send(event.data.buffer.slice(event.data.byteOffset, event.data.byteOffset + event.data.byteLength));
-      } else ws.send(event.data as Buffer);
+      const result = typeof event.data === "string"
+        ? ws.send(event.data)
+        : event.data instanceof ArrayBuffer
+          ? ws.send(event.data)
+          : ArrayBuffer.isView(event.data)
+            ? ws.send(event.data.buffer.slice(event.data.byteOffset, event.data.byteOffset + event.data.byteLength))
+            : ws.send(event.data as Buffer);
+      // The upstream cannot be paused; shed the socket as soon as Bun reports
+      // backpressure or a dropped send rather than building an application queue.
+      if (result <= 0) closeLiveSideband(ws, 1009, "backpressure limit");
     } catch {
       closeLiveSideband(ws, 1011, "client send failed");
     }
@@ -554,7 +570,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
   warnAgentTaskRecoveryStartup(config);
   setLiveStateStoreConfig(config);
   applyProxyEnv(config);
-  assertServerAuthConfig(config);
+  assertServerAuthConfig(config, { allowPlaintextRemoteForTests: allowPlaintextRemoteForTests() });
   const managementAuth = deps.managementAuthState ?? initializeManagementAuthState(config);
   let userCostOverlayReconciler: { stop(): void } | null = null;
   // Arm synchronously before listen. A pending journal therefore makes __main__ unusable
@@ -865,6 +881,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
     // release the owner-scoped lease on any listener failure.
     userCostOverlayReconciler = startUserCostOverlayReconciler({ liveConfig: config });
     const serveOptions = {
+      ...(config.tls ? { tls: { cert: Bun.file(config.tls.certFile), key: Bun.file(config.tls.keyFile) } } : {}),
       idleTimeout: 255,
       maxRequestBodySize: MAX_DECOMPRESSED_BODY_BYTES,
       async fetch(req: Request, requestServer: Server<WsData>): Promise<Response> {
@@ -931,13 +948,13 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
         }
         if (url.pathname === "/api/aistudio/session") {
           const origin = req.headers.get("Origin");
-          if (isAiStudioSessionOrigin(origin)) {
+          if (isAiStudioSessionOrigin(origin, policy)) {
             return new Response(null, {
               status: 204,
               headers: {
                 "Access-Control-Allow-Origin": origin as string,
                 "Access-Control-Allow-Methods": "POST, OPTIONS",
-                "Access-Control-Allow-Headers": "Content-Type, Authorization, X-OpenCodex-API-Key",
+                "Access-Control-Allow-Headers": "Content-Type, X-OpenCodex-API-Key",
                 Vary: "Origin, Access-Control-Request-Headers",
               },
             });
@@ -1005,16 +1022,19 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
       }
 
       if (url.pathname === "/api/aistudio/session" && req.method === "POST") {
-        const admission = resolveApiAuth(req, policy);
+        const dedicated = req.headers.get("x-opencodex-api-key")?.trim() ?? "";
+        const admission = dedicated
+          ? resolveDataPlaneAdmissionSecret(dedicated, config, "dedicated")
+          : null;
         if (!admission) {
-          return withAiStudioSessionCors(withCors(formatErrorResponse(401, "authentication_error", "opencodex API key required"), req, policy), req);
+          return withAiStudioSessionCors(withCors(formatErrorResponse(401, "authentication_error", "opencodex API key required"), req, policy), req, policy);
         }
         const origin = req.headers.get("Origin");
-        if (!isAllowedRequestOrigin(req, policy) && !isAiStudioSessionOrigin(origin)) {
-          return withAiStudioSessionCors(withCors(formatErrorResponse(403, "origin_rejected", "cross-origin request blocked"), req, policy), req);
+        if (!isAiStudioSessionOrigin(origin, policy)) {
+          return withAiStudioSessionCors(withCors(formatErrorResponse(403, "origin_rejected", "cross-origin request blocked"), req, policy), req, policy);
         }
         try {
-          const bodyJson = await req.json() as any;
+          const bodyJson = await readManagementJsonBody(req) as any;
           const { saveAiStudioSession, saveAiStudioSessionFromToken } = await import("../oauth/aistudio-session-sync");
           if (typeof bodyJson.token === "string" && bodyJson.token) {
             saveAiStudioSessionFromToken(bodyJson.token);
@@ -1025,11 +1045,16 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
               cookies: bodyJson.cookies,
             });
           } else {
-            return withAiStudioSessionCors(withCors(jsonResponse({ error: "invalid session payload" }, 400), req, policy), req);
+            return withAiStudioSessionCors(withCors(jsonResponse({ error: "invalid session payload" }, 400), req, policy), req, policy);
           }
-          return withAiStudioSessionCors(withCors(jsonResponse({ ok: true, message: "AI Studio session updated successfully" }), req, policy), req);
+          return withAiStudioSessionCors(withCors(jsonResponse({ ok: true, message: "AI Studio session updated successfully" }), req, policy), req, policy);
         } catch (error) {
-          return withAiStudioSessionCors(withCors(jsonResponse({ error: String(error) }, 400), req, policy), req);
+          const tooLarge = managementBodyTooLargeResponse(error, req, config);
+          return withAiStudioSessionCors(
+            withCors(tooLarge ?? jsonResponse({ error: "invalid session payload" }, 400), req, policy),
+            req,
+            policy,
+          );
         }
       }
 
@@ -1749,6 +1774,8 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
     websocket: {
       maxPayloadLength: MAX_WS_FRAME_BYTES,
       idleTimeout: WEBSOCKET_IDLE_TIMEOUT_SECONDS,
+      backpressureLimit: WEBSOCKET_BACKPRESSURE_LIMIT,
+      closeOnBackpressureLimit: true,
       // Responses WebSocket data plane (phase 120.2). Re-frames the same SSE pipeline onto the
       // socket: parse response.create → run handleResponses unchanged → pump its SSE body as WS
       // Text frames. response.processed is a no-op ack. close() aborts the upstream (RC2 parity).
@@ -1769,6 +1796,9 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
         ws.data.admissionLease.bind(ws);
         registerCodexWebSocket(ws);
       },
+      drain(ws: ServerWebSocket<WsData>) {
+        ws.data.wsDrain?.();
+      },
       message(ws: ServerWebSocket<WsData>, raw: string | Buffer) {
         if (ws.data.kind === "live-sideband") {
           if (ws.data.liveClosing) return;
@@ -1907,6 +1937,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
               },
             });
             await sendResponseToWebSocket(ws, response, isCurrent, {
+              abortSignal: turnAbort.signal,
               onSsePayload: payload => inspectResponseLogSsePayload(logCtx, payload),
               onTerminal: status => {
                 terminalRecorder?.(status, logCtx.terminalHttpStatus);
@@ -1957,6 +1988,8 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
         ws.data.admissionLease?.release();
         ws.data.admissionLease = undefined;
         ws.data.cancel?.(); // RC2: abort the upstream when the client disconnects
+        ws.data.wsDrainWaiter?.resolve();
+        ws.data.wsDrainWaiter = undefined;
       },
     },
     } as const;
@@ -1971,6 +2004,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
       try {
         loopbackServer = Bun.serve<WsData>({
           ...serveOptions,
+          tls: undefined,
           port: loopbackListenerPort,
           hostname: "127.0.0.1",
         });
@@ -2022,9 +2056,15 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
   setServerRef(server);
   const actualPort = server.port ?? listenPort;
   boundPort = actualPort;
+  managementApi.activeServerOrigin = canonicalServerOrigin(config, actualPort);
+  managementApi.activeServerConfig = {
+    hostname: config.hostname,
+    port: actualPort,
+    tls: config.tls ? { ...config.tls } : undefined,
+  };
   setCorsOrigin(actualPort);
 
-  console.log(`🚀 opencodex proxy running on http://localhost:${actualPort}`);
+  console.log(`🚀 opencodex proxy running on ${managementApi.activeServerOrigin}`);
   console.log(`   POST /v1/responses → provider translation`);
   console.log(`   POST /v1/chat/completions → OpenAI-compatible clients`);
   console.log(`   GET  /healthz      → health check`);

package/src/server/management/config-routes.ts

@@ -11,7 +11,9 @@ import {
   multiAgentGuidanceEnabled,
   providerBaseUrlConfigError,
   providerHeadersConfigError,
+  validateConfigCandidate,
 } from "../../config";
+import { canonicalServerOrigin, serverTlsConfigError } from "../../lib/server-tls";
 import {
   clearLoginState,
   getLoginStatus,
@@ -91,7 +93,7 @@ import { drainAndShutdown } from "../lifecycle";
 import { filterRequestLogs, getRequestLogEntries, type RequestLogEntry } from "../request-log";
 import { estimateComboCost, estimateRequestCost, normalizeCostTokens, tokensPerSecond } from "../../usage/cost";
 import type { PersistedUsageAttempt } from "../../usage/log";
-import { isAllowedRequestOrigin, jsonResponse, providerManagementConfigError, publicProviderBaseUrl, safeConfigDTO } from "../auth-cors";
+import { assertServerAuthConfig, configuredApiAuthToken, isAllowedRequestOrigin, jsonResponse, providerManagementConfigError, publicProviderBaseUrl, safeConfigDTO } from "../auth-cors";
 import { withProviderServiceTierDTO } from "./provider-capability-config";
 import { applySystemEnvToggle } from "../system-env";
 import { getCachedStartupHealth, invalidateStartupHealthCache } from "../startup-health-cache";
@@ -131,6 +133,40 @@ async function sidecarVisionResponseSettings(config: OcxConfig): Promise<{
   return { model, reasoning, models };
 }
 
+function aiStudioExtensionOrigin(config: Pick<OcxConfig, "corsAllowOrigins">): string | null {
+  return config.corsAllowOrigins?.find(origin => origin.startsWith("chrome-extension://")) ?? null;
+}
+
+function serverSettings(
+  config: OcxConfig,
+  activeOrigin?: string,
+  activeConfig?: Pick<OcxConfig, "hostname" | "port" | "tls">,
+) {
+  const active = activeOrigin ?? canonicalServerOrigin(config, config.port);
+  const configuredOrigin = canonicalServerOrigin(config, config.port);
+  const configuredListener = {
+    hostname: config.hostname ?? "127.0.0.1",
+    port: config.port,
+    tls: config.tls ?? null,
+  };
+  const activeListener = activeConfig && {
+    hostname: activeConfig.hostname ?? "127.0.0.1",
+    port: activeConfig.port,
+    tls: activeConfig.tls ?? null,
+  };
+  return {
+    configured: {
+      ...configuredListener,
+      aiStudioOrigin: aiStudioExtensionOrigin(config),
+    },
+    activeOrigin: active,
+    credentialConfigured: !!configuredApiAuthToken(config)
+      || (config.apiKeys ?? []).some(entry => !!entry.key.trim()),
+    restartRequired: active !== configuredOrigin
+      || !!activeListener && JSON.stringify(activeListener) !== JSON.stringify(configuredListener),
+  };
+}
+
 /** One client's outcome from a fan-out sync. Absent from the list means "left alone". */
 interface ClientIntegrationSyncOutcome {
   readonly client: "grok" | "claude-desktop" | "mcode";
@@ -304,6 +340,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       // Absent means the historical auto-open, so the GUI can render the toggle
       // without having to know that `undefined` and `true` mean the same thing.
       oauthOpenBrowser: config.oauthOpenBrowser !== false,
+      server: serverSettings(config, deps.activeServerOrigin, deps.activeServerConfig),
       startupHealth: await readStartupHealth(config),
       codexRuntime: {
         path: displayCodexRuntimePath(resolved.runtime.command),
@@ -390,14 +427,16 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       codexAccountPickerEnabled?: unknown;
       oauthOpenBrowser?: unknown;
       showCodexSparkQuota?: unknown;
+      server?: unknown;
     };
     if (body.codexAutoStart === undefined
       && body.streamMode === undefined
       && body.appOwnedMemoryBudgetMb === undefined
       && body.codexAccountPickerEnabled === undefined
       && body.oauthOpenBrowser === undefined
-      && body.showCodexSparkQuota === undefined) {
-      return jsonResponse({ error: "provide codexAutoStart, streamMode, appOwnedMemoryBudgetMb, codexAccountPickerEnabled, oauthOpenBrowser, or showCodexSparkQuota" }, 400);
+      && body.showCodexSparkQuota === undefined
+      && body.server === undefined) {
+      return jsonResponse({ error: "provide a supported settings field" }, 400);
     }
     if (body.codexAutoStart !== undefined && typeof body.codexAutoStart !== "boolean") {
       return jsonResponse({ error: "codexAutoStart boolean is required" }, 400);
@@ -415,6 +454,30 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     if (body.showCodexSparkQuota !== undefined && typeof body.showCodexSparkQuota !== "boolean") {
       return jsonResponse({ error: "showCodexSparkQuota boolean is required" }, 400);
     }
+    let nextServer: {
+      hostname: string;
+      port: number;
+      tls: OcxConfig["tls"];
+      aiStudioOrigin: string | null;
+    } | undefined;
+    if (body.server !== undefined) {
+      if (!isPlainRecord(body.server)) return jsonResponse({ error: "server must be an object" }, 400);
+      const raw = body.server;
+      if (typeof raw.hostname !== "string" || !raw.hostname.trim()) return jsonResponse({ error: "server.hostname must be a non-empty string" }, 400);
+      if (typeof raw.port !== "number" || !Number.isInteger(raw.port) || raw.port < 0 || raw.port > 65535) return jsonResponse({ error: "server.port must be an integer from 0 to 65535" }, 400);
+      const tlsError = raw.tls === null ? null : serverTlsConfigError(raw.tls);
+      if (tlsError) return jsonResponse({ error: tlsError }, 400);
+      if (raw.aiStudioOrigin !== null && (
+        typeof raw.aiStudioOrigin !== "string"
+        || !/^chrome-extension:\/\/[a-z]{32}$/.test(raw.aiStudioOrigin)
+      )) return jsonResponse({ error: "server.aiStudioOrigin must be an exact chrome-extension origin or null" }, 400);
+      nextServer = {
+        hostname: raw.hostname.trim(),
+        port: raw.port,
+        tls: raw.tls === null ? undefined : raw.tls as OcxConfig["tls"],
+        aiStudioOrigin: raw.aiStudioOrigin,
+      };
+    }
     if (body.appOwnedMemoryBudgetMb !== undefined && (
       typeof body.appOwnedMemoryBudgetMb !== "number"
       || !Number.isInteger(body.appOwnedMemoryBudgetMb)
@@ -438,36 +501,67 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       hasOauthOpenBrowser: Object.hasOwn(config, "oauthOpenBrowser"),
       showCodexSparkQuota: config.showCodexSparkQuota,
       hasShowCodexSparkQuota: Object.hasOwn(config, "showCodexSparkQuota"),
+      hostname: config.hostname,
+      hasHostname: Object.hasOwn(config, "hostname"),
+      port: config.port,
+      tls: config.tls,
+      hasTls: Object.hasOwn(config, "tls"),
+      corsAllowOrigins: config.corsAllowOrigins,
+      hasCorsAllowOrigins: Object.hasOwn(config, "corsAllowOrigins"),
     };
     const pickerWasEnabled = codexAccountPickerEnabled(config);
-    let pickerIsEnabled = pickerWasEnabled;
-    try {
+    const applySettings = (target: OcxConfig): boolean => {
       if (typeof body.codexAutoStart === "boolean") {
-        config.codexAutoStart = body.codexAutoStart;
+        target.codexAutoStart = body.codexAutoStart;
       }
       if (body.streamMode !== undefined) {
         if (body.streamMode === "auto") {
-          deleteConfigTopLevelKey(config, "streamMode");
+          deleteConfigTopLevelKey(target, "streamMode");
         } else {
-          config.streamMode = body.streamMode as "legacy-tee" | "eager-relay";
+          target.streamMode = body.streamMode as "legacy-tee" | "eager-relay";
         }
       }
       if (typeof body.appOwnedMemoryBudgetMb === "number") {
-        config.appOwnedMemoryBudgetMb = body.appOwnedMemoryBudgetMb;
+        target.appOwnedMemoryBudgetMb = body.appOwnedMemoryBudgetMb;
       }
       if (body.codexAccountPickerEnabled === true) {
-        config.codexAccountPickerEnabled = true;
-        initializeDefaultCodexAccountNamespaces(config);
+        target.codexAccountPickerEnabled = true;
+        initializeDefaultCodexAccountNamespaces(target);
       } else if (body.codexAccountPickerEnabled === false) {
-        config.codexAccountPickerEnabled = false;
+        target.codexAccountPickerEnabled = false;
       }
       if (typeof body.oauthOpenBrowser === "boolean") {
-        config.oauthOpenBrowser = body.oauthOpenBrowser;
+        target.oauthOpenBrowser = body.oauthOpenBrowser;
       }
       if (typeof body.showCodexSparkQuota === "boolean") {
-        config.showCodexSparkQuota = body.showCodexSparkQuota;
+        target.showCodexSparkQuota = body.showCodexSparkQuota;
+      }
+      if (nextServer) {
+        target.hostname = nextServer.hostname;
+        target.port = nextServer.port;
+        if (nextServer.tls) target.tls = nextServer.tls;
+        else deleteConfigTopLevelKey(target, "tls");
+        const origins = (target.corsAllowOrigins ?? []).filter(origin => !origin.startsWith("chrome-extension://"));
+        if (nextServer.aiStudioOrigin) origins.push(nextServer.aiStudioOrigin);
+        if (origins.length) target.corsAllowOrigins = origins;
+        else deleteConfigTopLevelKey(target, "corsAllowOrigins");
       }
-      pickerIsEnabled = codexAccountPickerEnabled(config);
+      return codexAccountPickerEnabled(target);
+    };
+    if (nextServer) {
+      const candidate = structuredClone(config);
+      applySettings(candidate);
+      const validation = validateConfigCandidate(candidate);
+      if (!validation.ok) return jsonResponse({ error: validation.error }, 400);
+      try {
+        assertServerAuthConfig(candidate);
+      } catch (error) {
+        return jsonResponse({ error: error instanceof Error ? error.message : String(error) }, 400);
+      }
+    }
+    let pickerIsEnabled = pickerWasEnabled;
+    try {
+      pickerIsEnabled = applySettings(config);
       saveManagementConfig(deps, config);
     } catch (error) {
       if (previousSettings.hasCodexAutoStart) config.codexAutoStart = previousSettings.codexAutoStart;
@@ -489,6 +583,13 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       if (previousSettings.hasShowCodexSparkQuota) {
         config.showCodexSparkQuota = previousSettings.showCodexSparkQuota;
       } else deleteConfigTopLevelKey(config, "showCodexSparkQuota");
+      if (previousSettings.hasHostname) config.hostname = previousSettings.hostname;
+      else deleteConfigTopLevelKey(config, "hostname");
+      config.port = previousSettings.port;
+      if (previousSettings.hasTls) config.tls = previousSettings.tls;
+      else deleteConfigTopLevelKey(config, "tls");
+      if (previousSettings.hasCorsAllowOrigins) config.corsAllowOrigins = previousSettings.corsAllowOrigins;
+      else deleteConfigTopLevelKey(config, "corsAllowOrigins");
       throw error;
     }
     if (typeof body.appOwnedMemoryBudgetMb === "number") {
@@ -512,6 +613,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       catalogRefreshPending,
       showCodexSparkQuota: config.showCodexSparkQuota === true,
       startupHealth: await readStartupHealth(config),
+      server: serverSettings(config, deps.activeServerOrigin, deps.activeServerConfig),
     });
   }
 

package/src/server/management/context.ts

@@ -18,6 +18,10 @@ import type {
 } from "../../codex/app-server-restart-service";
 
 export interface ManagementApiDeps {
+  /** Canonical origin captured from the running listener; management writes must not change it. */
+  activeServerOrigin?: string;
+  /** Listener settings captured at bind time so same-origin certificate/path edits still require restart. */
+  activeServerConfig?: Pick<OcxConfig, "hostname" | "port" | "tls">;
   /** Platform seam for capability projections; does not alter host-level startup behavior. */
   platform?: NodeJS.Platform;
   toggleCodexMultiAgentV2?: (enabled: boolean) => void;

package/src/server/management/provider-routes.ts

@@ -677,6 +677,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       // Presence only (#959 review): header names and values never leave the process.
       hasHeaders: !!p.headers && Object.keys(p.headers).length > 0,
       allowPrivateNetwork: p.allowPrivateNetwork === true,
+      replayTransientFailures: p.replayTransientFailures === true,
       liveModels: p.liveModels !== false,
       requestPacing: p.requestPacing,
       models: p.models ?? [],

package/src/server/responses/compact.ts

@@ -58,7 +58,6 @@ import {
   type CodexUpstreamOutcome,
 } from "../../codex/routing";
 import {
-  fetchWithResetRetry,
   fetchWithTransientRetry,
   applyUpstreamRecoveryInit,
   type UpstreamSendRecovery,
@@ -533,7 +532,11 @@ export async function handleResponsesCompact(
       });
       return recovery === "single"
         ? doFetch()
-        : fetchWithTransientRetry(doFetch, { abortSignal: req.signal, label: safeHostLabel(compactUrl) });
+        : fetchWithTransientRetry(doFetch, {
+          abortSignal: req.signal,
+          label: safeHostLabel(compactUrl),
+          replayTransientFailures: sendProvider.replayTransientFailures,
+        });
     };
 
     // The account each outcome belongs to. Reassigned only when the alternate send below

package/src/server/responses/core.ts

@@ -196,7 +196,6 @@ import {
 import { codexAuthContextLogLabel } from "../../codex/account-label";
 import {
   applyUpstreamRecoveryInit,
-  fetchWithResetRetry,
   fetchWithTransientRetry,
   prepareSameTarget429Wait,
   sleepWithAbort,
@@ -3702,6 +3701,7 @@ async function handleResponsesInner(
     linkAbortSignal(upstream, options.abortSignal);
     const connectMs = config.connectTimeoutMs ?? 200_000;
     let upstreamResponse: Response;
+    const replayBudget = route.provider.replayTransientFailures ? { remaining: 2 } : undefined;
     const transportFailureResponse = (err: unknown): Response => {
       upstream.abort();
       if (options.abortSignal?.aborted) {
@@ -3768,7 +3768,7 @@ async function handleResponsesInner(
               return res;
             });
         },
-        { abortSignal: upstream.signal, label: safeHostLabel(request.url) },
+        { abortSignal: upstream.signal, label: safeHostLabel(request.url), replayTransientFailures: route.provider.replayTransientFailures, replayBudget },
       );
     } catch (err) {
       return transportFailureResponse(err);
@@ -3843,7 +3843,7 @@ async function handleResponsesInner(
                 return response;
               });
           },
-          { abortSignal: upstream.signal, label: safeHostLabel(request.url) },
+          { abortSignal: upstream.signal, label: safeHostLabel(request.url), replayTransientFailures: route.provider.replayTransientFailures, replayBudget },
         );
       } catch (err) {
         return { failed: transportFailureResponse(err) };
@@ -3959,7 +3959,7 @@ async function handleResponsesInner(
                 return res;
               });
           },
-          { abortSignal: upstream.signal, label: safeHostLabel(request.url) },
+          { abortSignal: upstream.signal, label: safeHostLabel(request.url), replayTransientFailures: route.provider.replayTransientFailures, replayBudget },
         );
       } catch (err) {
         return transportFailureResponse(err);
@@ -4021,7 +4021,7 @@ async function handleResponsesInner(
                 return res;
               });
           },
-          { abortSignal: upstream.signal, label: safeHostLabel(request.url) },
+          { abortSignal: upstream.signal, label: safeHostLabel(request.url), replayTransientFailures: route.provider.replayTransientFailures, replayBudget },
         );
       } catch (err) {
         return transportFailureResponse(err);
@@ -5353,6 +5353,7 @@ async function handleResponsesInner(
    */
   const invalidateSameTargetRequest = (): void => { transportToken += 1; };
   let upstreamResponse: Response;
+  const replayBudget = route.provider.replayTransientFailures ? { remaining: 2 } : undefined;
   try {
     if (activeAdapter.fetchResponse) {
       noteDiagnosticAttempt(logCtx.activeAttempt, inputTokenEstimate, undefined, activeAdapter.name);
@@ -5361,20 +5362,17 @@ async function handleResponsesInner(
         abortSignal: upstream.signal,
         timeoutMs: connectMs,
         stream: parsed.stream,
-        executor: providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+          executor: providerFetch(route.provider, options.codexWsRuntimeIdentity, {
           providerName: route.providerName,
           modelId: route.modelId,
           pacingSlotAcquired: true,
-        }),
+          }),
+          replayBudget,
         ...(antigravityAccountId ? { accountId: antigravityAccountId } : {}),
       });
     } else {
-      // #1851 scope guard: transient-5xx retry on this generic adapter path is opt-in for
-      // direct Google AI Studio only (Vertex/Antigravity use fetchResponse above). Other
-      // adapters keep reset-only retry so combo failover still hops on the first 5xx
-      // instead of burning ~1.2s of same-target retries per hop.
-      const fetchWithRetryPolicy = route.provider.adapter === "google" ? fetchWithTransientRetry : fetchWithResetRetry;
-      upstreamResponse = await fetchWithRetryPolicy(
+      // One coordinator owns reset and transient-5xx replay for every generic adapter.
+      upstreamResponse = await fetchWithTransientRetry(
         recovery => {
           noteDiagnosticAttempt(logCtx.activeAttempt, inputTokenEstimate, recovery, activeAdapter.name);
           return fetchWithHeaderTimeout(builtInitialRequest.url, applyUpstreamRecoveryInit({
@@ -5387,7 +5385,7 @@ async function handleResponsesInner(
               modelId: route.modelId,
             }));
         },
-        { abortSignal: upstream.signal, label: safeHostLabel(builtInitialRequest.url) },
+        { abortSignal: upstream.signal, label: safeHostLabel(builtInitialRequest.url), replayTransientFailures: route.provider.replayTransientFailures, replayBudget },
       );
     }
   } catch (err) {
@@ -6055,13 +6053,12 @@ async function handleResponsesInner(
               modelId: nextParsed.modelId,
               pacingSlotAcquired: true,
             }),
+            replayBudget,
             ...(antigravityAccountId ? { accountId: antigravityAccountId } : {}),
           });
         }
-        // Same #1851 scope guard as the initial send: transient-5xx retry only for direct
-        // Google AI Studio; every other adapter keeps reset-only semantics here.
-        const fetchContinuationWithRetryPolicy = route.provider.adapter === "google" ? fetchWithTransientRetry : fetchWithResetRetry;
-        return await fetchContinuationWithRetryPolicy(
+        // Continuations consume the same generation-scoped transient replay allowance.
+        return await fetchWithTransientRetry(
           recovery => {
             noteDiagnosticAttempt(logCtx.activeAttempt, continuationEstimate, recovery ?? replayKind, activeAdapter.name);
             return fetchWithHeaderTimeout(
@@ -6080,7 +6077,7 @@ async function handleResponsesInner(
               }),
             );
           },
-          { abortSignal: upstream.signal, label: safeHostLabel(builtContinuationRequest.url) },
+          { abortSignal: upstream.signal, label: safeHostLabel(builtContinuationRequest.url), replayTransientFailures: route.provider.replayTransientFailures, replayBudget },
           );
       } finally {
         builtContinuationRequest.releaseBodyObservation?.();